api

One request decompiles one script and gives you JSON back. For .rbxl/.rbxm files, use the site. For lots of scripts at once, use the stream.

request

POSThttps://api.unreadable.gg/v1/decompile

Send the script's bytecode as the body, with Content-Type: application/octet-stream. Every format on the Luau page works, RSB1-wrapped files included.

curl.exe https://api.unreadable.gg/v1/decompile \`
  -H "Content-Type: application/octet-stream" \`
  --data-binary @module.luac"@module.luac"

import pathlib, requests

r = requests.post(
    "https://api.unreadable.gg/v1/decompile",
    headers={"Content-Type": "application/octet-stream"},
    data=pathlib.Path("module.luac").read_bytes(),
)
body = r.json()
if not r.ok:
    raise SystemExit(f"{body['error']['code']}: {body['error']['message']}")
pathlib.Path("module.luau").write_text(body["source"], encoding="utf-8")

// Node 18 or later, saved as an .mjs file
import { readFile, writeFile } from "node:fs/promises";

const r = await fetch("https://api.unreadable.gg/v1/decompile", {
  method: "POST",
  headers: { "Content-Type": "application/octet-stream" },
  body: await readFile("module.luac"),
});
const body = await r.json();
if (!r.ok) throw new Error(`${body.error.code}: ${body.error.message}`);
await writeFile("module.luau", body.source);

with options

To set options, send JSON instead: the file in base64 as bytecode, and your options in options.

printf '{"bytecode":"%s","options":{"preset":"balanced"}}' "$(base64 < module.luac | tr -d '\n')" |
  curl https://api.unreadable.gg/v1/decompile \
    -H "Content-Type: application/json" \
    --data-binary @-

import base64, pathlib, requests

r = requests.post(
    "https://api.unreadable.gg/v1/decompile",
    json={
        "bytecode": base64.b64encode(pathlib.Path("module.luac").read_bytes()).decode(),
        "options": {"preset": "balanced"},
    },
)

The API is strict. An unknown field, a query parameter or a bad value gets a 400 that names the field.

progress

Send Accept: application/x-ndjson and you get progress while it runs, one JSON object per line. Without it, you get one JSON body at the end.

If the decompile fails after the 200, the last line is an error instead, {"stage":"error",…}. The status is already sent, so Retry-After comes as retryAfter.

from a browser

Only unreadable.gg can call the API from a web page. Call it from your server instead, or use the stream with a key.

response

A decompile that runs returns 200 and JSON, whatever the verdict.

{
  "source": "local function area(width: number, height) -- unreadable.gg ~ 12ms\n...",
  "verdict": "decompiled-unverified",
  "notes": [],
  "functions": [{ "id": 1, "name": "area", "line": 1, "endLine": 3, "parent": null, "inputLine": 1 }],
  "calls": [],
  "setting": { "preset": "faithful", "overrides": {}, "switches": { "freeLines": false, "...": false }, "spent": [], "implied": {}, "blocked": {} },
  "version": "2026.10.16-90a500a"
}

options

{"preset": "readable", "inferredTypes": false} is readable with inferred types turned off.

notes

Each note explains one thing behind the verdict. If it's about a spot or a function, it's also in the source as a -- unreadable: comment.

{
  "code": "function-refused",
  "function": "label",
  "functionId": 2,
  "line": 6,
  "message": "this function was not decompiled, because it has a loop that can't be written as `while`, `repeat` or `for` yet; calling it raises an error",
  "detail": "proto 2 pc 14: …"
}

• function: the name the source prints, like v0. null for the main chunk and unnamed functions.
• functionId: the functions entry it's about. null for the main chunk or the whole file.
• line: where the function starts in your original. null if the file has no line info.
• message: what happened.
• remedy (sometimes): what would fix it. The source prints it as fix:.
• detail (sometimes): the decompiler's own wording, for bug reports. Not in the source.

The last three are about the whole file, so they're not in the source. More codes may come later. If you get one you don't know, treat it like spot-marked: that part may not match your original.

errors

Errors are JSON with a code, a message, and the field at fault if there is one. They don't use up a free decompile, except timed-out.

{ "error": { "code": "invalid-option", "message": "Option `inferredTypes` must be true or false.", "field": "options.inferredTypes" } }

For most 4xx, fix the request. For 402, wait for midnight UTC. For 429 and 503, wait Retry-After seconds and try again. 500 is our fault. For 504, see its row.

limits

Free limits count per connection: one IP address (with IPv6, one /64 range). Member limits count per account, across all its keys. Daily limits reset at midnight UTC.

Decompile time is how long your decompiles take on our servers. Naming counts too, with modelNames.

A network is your internet provider, VPN or mobile carrier, so a new address on the same one doesn't count again. A network stays in use for 2 minutes after its last decompile, or as long as a stream from it is open. Open streams are never cut off by the network limit.

The size limit is on the file, so a base64 JSON body can be about a third bigger. Very large files can run out of memory and fail with 500.

free tier

You get 100 free decompiles a day, shared by the site, the executor and the API. The Discord bot has the same limit, counted per Discord account. Errors and refusals don't count, except timed-out. Closing a request mid-decompile still counts.

Most responses have a Free-Remaining header with how many you have left today. Members get it too, but their own decompiles don't lower it.

Free-Remaining: 3

Requests turned away before decompiling, like a wrong key (401), a file that's too big (413) or a wrong Content-Type (415), don't have it.

keys and accounts

A membership lifts the free limits, takes files up to 8 MiB and gives each decompile up to 300 seconds. Its tier sets your decompile time a day. Every other limit is the same for all tiers.

Scripts a day is an estimate at 50 ms a script. Big scripts take longer.

To get a membership, check out #purchase in our Discord server. Make an account and its keys on the account page, then send a key with each request:

curl https://api.unreadable.gg/v1/decompile \
  -H "Authorization: Bearer ugk_..." \
  -H "Content-Type: application/octet-stream" \
  --data-binary @module.luac

Every member response has a Member-Until header that says when the membership ends. After that, the key falls back to the free tier. A wrong key always gets 401, never the free tier.

Programs can manage the account too. The account number (UG-XXXX-XXXX-XXXX-XXXX-C) is the sign-in, so it goes in the JSON body, never the URL:

We show the account number and each key once and only store a hash, so save them somewhere safe. Twenty wrong account numbers in a day gets a connection a 429.

Accounts that never had a membership are deleted after 90 days. Ones that did are deleted a year after the membership ends or a key was last used, whichever is later.

decompiler version

Every response names the decompiler version in version and in this header:

Decompiler-Version: 2026.10.11-4227ea3

The same file, options and version always give the same source and notes. The only exceptions are the time on line 1 and, with modelNames, the names it picks. The changelog lists what changed.

support

If a decompile runs differently from your original, or you find a bug, open a #support ticket in our Discord server or mail support@unreadable.gg. Send the file, the options and the version. We fix wrong programs first.